Privacy policy

1. Introduction

Grand Luxe Autos ("GLA", "we", "us", "our") operates the website and platform at grandluxeautos.com and app.grandluxeautos.com (the "Platform"), a multi-vendor marketplace connecting buyers with dealers and individual owners of pre-owned and luxury vehicles across India, and offering ancillary services such as vehicle registration (RC) verification, auctions, test-drive scheduling, and dealer management tools.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDPA") and other applicable Indian law. It applies to every visitor, registered customer, dealer, and staff user of the Platform ("you").

By using the Platform, you consent to the collection and use of your information as described here. If you do not agree, please do not use the Platform.

2. Data we collect

2.1 What you give us directly

• Account information — name, email address, mobile number, and password, when you register as a customer or dealer.
• Profile information — residential or business address, city, and, for sellers receiving payouts, bank account holder name, account number, IFSC code, and bank name.
• Identity and KYC documents — where required to complete a sale (for example, a Sale Invoice or Vehicle Delivery Note issued by a dealer), we or the dealer may collect your Aadhaar number, PAN, father's name, and address. This is sensitive personal data, collected only where necessary to issue statutory sale documentation, and it is never published on any public page.
• Vehicle information — registration number, make, model, year, odometer reading, and photographs, plus, where you use our RC-verification tools, the underlying registration record, which can include the registered owner's name, chassis and engine numbers, insurance and PUC validity, and financier details. Owner name, chassis number, and engine number are masked wherever we display this information back to you or to other users.
• Transaction information — bookings, test-drive requests, offers, auction bids, and dealer subscription and payment history.
• Communications — messages you send us, enquiries submitted through service or contact forms, and records created when a dealer logs an in-person ("walk-in") enquiry on your behalf.

2.2 What we collect automatically

• Device and usage data — IP address, browser type, pages visited, and session identifiers, collected via cookies and similar technologies (see §7).
• Rate-limiting records — to prevent misuse of our metered RC-verification service, we log each lookup you make (registration number searched, timestamp, and account) and cap the number of lookups any one account may perform in a day.

2.3 What we receive from third parties

• Payment confirmation data from our payment processor, Razorpay, when you make a payment. We do not receive or store your full card, UPI, or net-banking credentials — these are handled directly by Razorpay under its own PCI-DSS-compliant systems.
• Registration and ownership data from our RC-verification partner, used strictly to power the vehicle-check features described above.

3. Why we use your data

We process personal data only for the following purposes, consistent with Section 4 of the DPDPA:

1. to create and administer your account and authenticate you;
2. to operate the marketplace — publishing listings, and processing bookings, test drives, offers, and auctions;
3. to verify vehicle registration details and reduce fraud, for the benefit of both buyers and sellers;
4. to generate legally required sale documentation (invoices, delivery notes) when a vehicle is sold through a dealer on the Platform;
5. to process payments and dealer subscription billing;
6. to send transactional communications — booking confirmations, OTPs, reminders — by SMS or email;
7. to respond to support requests and enforce our Terms of Use;
8. to detect, investigate, and prevent fraud, abuse, and violations of our policies, including enforcing the daily limit on RC lookups; and
9. to comply with applicable law, regulation, legal process, or governmental request.

4. Legal basis and consent

We collect and process personal data on the basis of your consent, given when you register, submit a form, or click "I agree"; or because processing is necessary to perform a contract with you, to comply with a legal obligation (for example, retaining sale invoices for tax purposes), or for our legitimate interests in operating and securing the Platform. You may withdraw consent at any time by writing to our Grievance Officer (§12); this will not affect processing already carried out, or our ability to retain records we are legally required to keep.

5. Sharing and disclosure

We share personal data only as follows:

• with the dealer or direct owner of a vehicle you enquire about, book, or buy, to the extent necessary to complete that transaction — for example, your name and phone number once you make a booking or an offer;
• with our payment processor, Razorpay, to process payments;
• with our RC-verification partner, solely to perform the lookup you request;
• with service providers who help us run the Platform — hosting, SMS delivery — under confidentiality obligations, and only to the extent needed to provide their service;
• with law enforcement, courts, or regulators, where required by law or to protect the rights, property, or safety of GLA, our users, or the public; and
• in connection with a merger, acquisition, or sale of assets, subject to the acquirer being bound by materially equivalent privacy commitments.

6. Data retention

We retain personal data only as long as necessary for the purposes above, or as required by law. As a guide: account data is retained while your account is active and for a reasonable period after closure to resolve disputes; sale invoices, delivery notes, and related KYC records are retained for the period required under applicable tax and consumer-protection law, currently up to eight years; RC-lookup logs are retained for a limited period sufficient to operate the daily-limit and fraud-prevention controls described in §2.2. You may request earlier deletion under §9, subject to our legal retention obligations.

7. Cookies

We use strictly necessary cookies, to keep you logged in and remember your session, and functional cookies, for example to avoid double-counting a page view when calculating how many people have viewed a listing. We do not use third-party advertising or tracking cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Platform from working.

8. Data security

We follow reasonable security practices and procedures as required under the Information Technology Act, 2000 and the rules made under it, including access controls; masking of sensitive identifiers — Aadhaar, PAN, chassis number, engine number, owner name — in customer- and buyer-facing views; encrypted transmission (HTTPS) across the Platform; and restricting access to sensitive documents, such as generated sale invoices, to the dealer who issued them. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Under the DPDPA and applicable law, you have the right to:

• access a summary of the personal data we hold about you and how it is processed;
• correct inaccurate or incomplete personal data;
• request erasure of personal data no longer necessary for the purpose it was collected, subject to our legal retention obligations;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and
• lodge a grievance with our Grievance Officer (§12), and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, write to us using the contact details in §12. We will respond within the timeframe prescribed under applicable law.

10. Children's data

The Platform is intended for users at least 18 years old and legally capable of entering into a binding contract under the Indian Contract Act, 1872, since transactions on the Platform involve payments and vehicle ownership. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy with an updated "Last Updated" date, and where changes are material, we will notify you by email or an in-app notice.